All Apps and Add-ons

Sideview Utils: How to display a button based on a field returned by a search result?

spyme72
Path Finder

i want to display a button in my view and i am using Sideview utils.
i want the button to be displayed based on a field returned by a search result.

example:

index=abc | fields user, status,tobedeleted

if the field tobedeleted is true i want to display a button,else i dont want the button to be displayed.

sideview
SplunkTrust
SplunkTrust

Certainly. Here is a simple self-contained example where there is a field called "showme" whose value is either "true" or "false". And the Button is embedded only inside hte Table rows that have showme="true".

<module name="Search" layoutPanel="panel_row4_col2" autoRun="True" group="Buttons only show for some rows">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_sourcetype_thruput" | head 1000 | stats sum(kb) as totalKB by series | eval actions="PLACEHOLDER" | streamstats count | eval showme=if(count=="2","true","false")
  ]]></param>

  <module name="Pager">

    <module name="Table">

      <module name="ValueSetter" group="row.fields.actions">
        <param name="name">foo</param>
        <param name="if.$row.fields.showme$=true">1</param>

        <module name="Gate">
          <param name="requiredKeys">foo</param>

          <module name="Button">
            <param name="allowAutoSubmit">False</param>
            <param name="customBehavior">confirmationPopup</param>

            <module name="Redirector">
              <param name="popup">True</param>
              <param name="url">http://google.com</param>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

You can of course use the Table module's "hiddenFields" to hide the actual rendered "showme" or "tobedeleted" column from the end user and it will still work.

As to how/why this implementation works -- the ValueSetter module uses it's conditional logic to create a $foo$ token that will only be defined on certain rows. Then the Gate module will either block or allow the downstream push based on that token. Then last but not least the Button module happens to have a behavior where it wont render itself until the first push is received.

If the Button didn't have that default behaviour then we'd have to cook up another way, possibly using the Sideview ShowHide module.

spyme72
Path Finder

awesome that's good to know.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...